feat: the server checks the grade against the files before approving

The price depends on the grade, which the browser worked out and the API
took on trust. Before a cart is approved at checkout the API now recomputes
it from the uploaded files by the Site's own rules: the pixel size in a
PNG, JPG or WebP header across the printed width (rotation included), and
the area-weighted DPI of the images placed in a PDF of up to 150 MB, 300
for vectors. Sheets take the worst grade, artworks the average. A claim more
than 2 points above the file's grade, or a discount on a file the server
cannot grade, waits for an operator, with the reason on the Kanban.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/quote_review.py

@@ -6,11 +6,11 @@ moment it was created. The Site is a shop: a customer who can price the order
 should be able to pay for it straight away, at any hour, so only orders a
 person must look at before charging wait for the Kanban (review_reason).
 
-Known limit: the grade (and so the discount) and the layout are still worked
-out in the customer's browser (roadmap 3.2, 3.9). The API checks the layout's
-geometry and that an unanalysed item carries no discount, but a customer who
-edits the page can claim a better grade. Operators see every order's grade
-and artwork at Arte recebida.
+The grade (and so the discount) is worked out in the customer's browser and
+checked against the files before an automatic approval (app/grade_check.py);
+a grade the files do not support waits for review. The layout is still the
+browser's (roadmap 3.9): the API checks its geometry. Operators see every
+order's grade and artwork at Arte recebida.
 """
 import os
 from decimal import Decimal